# PhishDestroy domain threat record: ethlaunch.fun Content language: English Canonical HTML report: https://phishdestroy.io/domain/ethlaunch.fun/ Machine-readable companion: https://phishdestroy.io/domain/ethlaunch.fun/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 12:55:32 UTC - Last availability or vendor check: 2026-10-22 12:55:32 UTC - Stored record updated: 2026-10-22 16:30:30 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Ethereum ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-19 14:58:26 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a163ad-8ce6-74fc-8f22-ff0cdb24e743/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/ethlaunch.fun - Certificate Transparency search: https://crt.sh/?q=%25.ethlaunch.fun - Web Archive lookup: https://web.archive.org/web/*/https://ethlaunch.fun/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI flagged ethlaunch.fun as malicious because the page claims to be an “Ethereum Token Creator” and asks visitors to connect a MetaMask wallet to create an ERC‑20 token, a pattern commonly used by wallet‑drainer sites. The page title recorded on 2026-10-22 reads “ETH Launch — Ethereum Token Creator” and the site returned an HTTP 200 response on that date. The domain was first seen by PhishDestroy on 2026-10-22, three days after its registration on 2026-10-19. How the scam works A typical wallet‑drainer presents a legitimate‑sounding service—such as token creation—to persuade a user to grant a Web3 wallet like MetaMask permission to interact with the blockchain. Once the user approves, the attacker can request token transfers, approve unlimited spenders, or otherwise move assets without further user interaction. Evidence VirusTotal scanned the domain on 2026-10-22 and reported zero detections out of 92 engines. Google Safe Browsing checked the same day and did not flag the site. OTX listed three pulses referencing the domain as of 2026-10-22. PhishDestroy’s internal blocklist contains the domain, Cloudflare Radar classified the page as phishing, and urlscan.io captured the page on 2026-10-22; its machine‑learning engine gave a malicious score of 81 and tagged it as phishing, though the overall verdict was not malicious. Infrastructure The domain was registered on 2026-10-19 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Hosting is provided via Cloudflare, with the recorded IP 188.114.96.3 and a Let’s Encrypt TLS certificate valid until 2027-01-17. What to do Users should not connect any wallet to ethlaunch.fun; if a connection was already approved, revoke all permissions in the wallet and consider moving funds to a new address. Organizations can add the exact domain to web‑filtering or DNS blocklists and monitor outbound connections for requests to the recorded IP or Cloudflare network. Continue to monitor threat‑intel feeds for any updates on this domain. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a163ad-8ce6-74fc-8f22-ff0cdb24e743/ Cloudflare Radar report: https://radar.cloudflare.com/scan/99317b03-2765-4988-9bf5-de098c469b3f URLQuery report: https://urlquery.net/report/8d7f839a-1634-4165-9177-f2b70e2fd0b5 Stored capture screenshot: https://i.ibb.co/JFbZwpbT/6d304f2b1949.png Cloudflare Radar screenshot (2026-10-22T12:56:03Z): https://screenshots.phishdestroy.io/cf/99317b03-2765-4988-9bf5-de098c469b3f.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/8d7f839a-1634-4165-9177-f2b70e2fd0b5.png URLScan screenshot (2026-10-22T12:58:11Z): https://screenshots.phishdestroy.io/us/01a163b0-a608-738d-bf60-7426264ecc8a.png URLScan capture report: https://urlscan.io/result/01a163b0-a608-738d-bf60-7426264ecc8a/ VirusTotal report: https://www.virustotal.com/gui/domain/ethlaunch.fun Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ethlaunch.fun Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 13:29:13 UTC ## Stored page captures - Primary capture: https://i.ibb.co/JFbZwpbT/6d304f2b1949.png Captured: 2026-10-22 12:55:32 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a163ad-8ce6-74fc-8f22-ff0cdb24e743.png Captured: 2026-10-22 12:55:32 UTC Source report: https://urlscan.io/result/01a163ad-8ce6-74fc-8f22-ff0cdb24e743/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/99317b03-2765-4988-9bf5-de098c469b3f.png Captured: 2026-10-22 12:56:03 UTC Source report: https://radar.cloudflare.com/scan/99317b03-2765-4988-9bf5-de098c469b3f SHA-256: 55023a1a3dddef670dc89023143f87c74dd8cf9f7d9a26d6ebc6bdecfe8f7eb9 - URLQuery: https://screenshots.phishdestroy.io/uq/8d7f839a-1634-4165-9177-f2b70e2fd0b5.png Source report: https://urlquery.net/report/8d7f839a-1634-4165-9177-f2b70e2fd0b5 SHA-256: 13eff8644c351cb8b1b5f86b6e6f11341d6f3e007f62bb15dce5a73e58db5dcb - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163b0-a608-738d-bf60-7426264ecc8a.png Captured: 2026-10-22 12:58:11 UTC Source report: https://urlscan.io/result/01a163b0-a608-738d-bf60-7426264ecc8a/ SHA-256: a822ab44f61648108e2bf7779b12acd804f79a2017219878a9c514686cdaef9f ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T12:56:50Z", "uuid": "01a163ad-8ce6-74fc-8f22-ff0cdb24e743", "scanned_at": "2026-10-22T12:55:08Z", "final_url": "https://ethlaunch.fun/", "status": 200, "ip": "104.21.6.232", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com", "www.cloudflare.com", "static.cloudflareinsights.com" ], "ips": [ "104.16.123.96", "142.251.211.67", "104.16.80.73", "142.251.179.95", "104.21.6.232" ], "asns": [ "13335", "15169" ], "countries": [ "US" ], "doc_hash": "3c5cc7c3ac5ba07c4f922ddad260d16e6a84fe94b839de16b373ea0e46566c52", "script_hashes": [ "e74494b579b764f1824e4268ab878b44dfd7f5ae7d3b2fdaee0db574ca729edd" ], "globals": [ "openModal", "short", "setWallet", "disconnect", "updateFee", "previewFile", "valid", "_qlk1", "litPropertyMetadata", "reactiveElementVersions", "litHtmlVersions", "litElementVersions", "ondefecated", "ModalController", "TelegramGameProxy", "Telegram", "TelegramGameProxy_receiveEvent", "__cfBeacon", "eip6963ProviderDetails", "clientLogger", "$", "$$", "state", "walletModal", "reviewModal", "successModal", "open", "close", "lastTouchEnd" ], "storage_keys": [ "geoip_cf", "visit" ], "tls": { "san": [ "*.ethlaunch.fun", "ethlaunch.fun" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "ethlaunch.fun", "protocol": "QUIC", "valid_to": "2027-01-17T16:08:54Z", "valid_from": "2026-10-19T16:08:55Z" }, "domain_age_days": 523, "apex_age_days": 523, "tls_age_days": 2, "tls_valid_days": 89, "requests": 14, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 81, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T12:56:51Z", "uuid": "99317b03-2765-4988-9bf5-de098c469b3f", "scanned_at": "2026-10-22T12:56:03Z", "final_url": "https://ethlaunch.fun/", "status": 200, "history": [ { "url": "https://ethlaunch.fun/", "status": 200 } ], "dom_hash": "d1588b42f8419a2a460bb381e33f409c4d95ea5c06bf963c59882b362d384e55", "doc_hash": "3c5cc7c3ac5ba07c4f922ddad260d16e6a84fe94b839de16b373ea0e46566c52", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ethlaunch.fun", "type": "A", "value": "104.21.6.232" }, { "name": "ethlaunch.fun", "type": "A", "value": "172.67.135.113" }, { "name": "ethlaunch.fun", "type": "AAAA", "value": "2606:4700:3035::6815:6e8" }, { "name": "ethlaunch.fun", "type": "AAAA", "value": "2606:4700:3037::ac43:8771" } ], "dnssec_valid": false, "ip": "104.21.6.232", "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-19T16:58:25Z", "updated": "2026-10-19T17:00:17Z", "expires": "2027-10-19T16:58:25Z", "nameservers": [ "lynn.ns.cloudflare.com", "walk.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T13:27:55Z", "analysis_at": "2026-10-22T12:58:01Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-19T16:58:25Z", "expires": "2027-10-19T16:58:25Z", "updated": "2026-10-19T17:00:17Z", "first_seen": "2025-05-16T15:03:39Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::6815:6e8" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "lynn.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.135.113" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::ac43:8771" }, { "ttl": 300, "type": "A", "value": "104.21.6.232" }, { "ttl": 21600, "type": "NS", "value": "lynn.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "walk.ns.cloudflare.com" } ], "dns_at": "2026-10-22T12:58:26Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.ethlaunch.fun", "ethlaunch.fun" ], "issuer": "Let's Encrypt / YE1", "serial": "6077021a4f5d0273736c00bfe9681e0d332", "sha256": "b37feebf706b45d45fcf40586679d64473c60771f2ae047c5987cb797dd3654c", "subject": "ethlaunch.fun", "valid_to": "2027-01-17T16:08:54Z", "valid_from": "2026-10-19T16:08:55Z" }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765", "registrar_url": "https://nicenic.com", "created": "2026-10-19T16:00:00Z", "updated": "2026-10-19T16:00:00Z", "expires": "2027-10-19T16:00:00Z", "status": [ "addPeriod", "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "lynn.ns.cloudflare.com", "walk.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-10-19T16:00:00Z", "registration": "2026-10-19T16:00:00Z", "registrar expiration": "2027-10-19T16:00:00Z", "last update of RDAP database": "2026-10-19T16:00:00Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T12:57:09Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "ethlaunch.fun" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2025-07-14T19:23:24Z", "first": "2025-07-14T19:23:24Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 291 }, "social_tags": { "title": "ETH Launch — Ethereum Token Creator", "themeColor": "#050505", "description": "ETH Launch — create and prepare your Ethereum token in minutes." }, "trackers": { "requests": 11, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 3 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 62, "wait": 276, "connect": 11, "download": 0 }, "response_ms": 351 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 30000, "co2_grams": 0.0011, "cleaner_than": 48 }, "dns_server": { "ns": [ { "ip": "108.162.193.201", "host": "lynn.ns.cloudflare.com" }, { "ip": "108.162.194.128", "host": "walk.ns.cloudflare.com" } ], "zone": "ethlaunch.fun" }, "location": { "ip": "2a06:98c1:3121::9", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "ethlaunch.fun" }, "dns": { "A": [ "188.114.97.9", "188.114.96.9" ], "NS": [ "walk.ns.cloudflare.com", "lynn.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"lynn.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418027982, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::9", "2a06:98c1:3120::9" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::9", "family": 6 }, "redirects": { "chain": [ "https://ethlaunch.fun" ] }, "subdomains": { "count": 1, "subdomains": [ "www.ethlaunch.fun" ] }, "tech_stack": { "technologies": [ "lit-html", "lit-element", "Cloudflare", "HTTP/3" ] }, "linked_pages": { "internal_count": 3 }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-19T16:58:25Z", "updated": "2026-10-19T17:00:17Z", "expires": "2027-10-19T16:58:25Z", "status": [ "clientTransferProhibited https://icann.org/epp", "clientDeleteProhibited https://icann.org/epp", "addPeriod https://icann.org/epp" ], "nameservers": [ "lynn.ns.cloudflare.com", "walk.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } } } } ```